UDP traffic

Datagrams matching proto:dns sent to HoneyLabs sensors over UDP in the last 7 days. DNS questions and QUIC client fingerprints are decoded on the sensor. Other datagrams are kept as their first bytes and labelled by protocol where it can be recognised.

A UDP source address can be forged, so each address listed here either sent the traffic or was impersonated by whoever did. UDP traffic is kept out of verdicts, feeds, watchlists and alerts.

Clear search

Your plan searches up to 7d, so 30d was shortened. Plans

927

Datagrams

338

Source addresses

Networks

Countries

Destination ports

Traffic by type

Service queries

927 datagrams from 338 sources

Requests a service answers without a handshake. Scanners send them to find open DNS, NTP, SNMP or SSDP servers, which are also the servers reflection attacks abuse.

DNS 917 NetBIOS 10

Latest DNS datagram, to 53/udp

DNS query A dnsscan.shadowserver.org

payload bytes

00000000  fa ce 01 00 00 01 00 00  00 00 00 00 07 64 6e 73  |.............dns|
00000010  73 63 61 6e 0c 73 68 61  64 6f 77 73 65 72 76 65  |scan.shadowserve|
00000020  72 03 6f 72 67 00 00 01  00 01                    |r.org.....|

Amplification checks

Probes for services that answer a small request with a much larger reply, the property reflection attacks rely on.

Service	Port	Datagrams	Sources	Factor
DNS	53/udp +3	781	258	28 to 54
mDNS	5353/udp	136	93	2 to 10
NetBIOS	139/udp +3	10	4	3.8

The factor is how many bytes a reachable server can send back for each byte it receives, as published by CISA in alert TA14-017A.

Destination ports

53/udp DNS666
5353/udp DNS136
623/udp DNS18
17185/udp DNS17
5355/udp DNS8
17186/udp DNS5
51/udp DNS4
55/udp DNS4
139/udp NetBIOS4
17184/udp DNS4
15353/udp DNS4
5351/udp DNS4

DNS questions

DNS record types

TXT313
ANY215
A166
PTR163
NS4

Networks

AS396982 Google LLC from 106 sources213
AS16509 Amazon.com, Inc. from 6 sources72
AS398324 Censys, Inc. from 27 sources69
AS6939 Hurricane Electric LLC from 45 sources49
AS215925 Vpsvault.host Ltd from 4 sources46
AS51396 Pfcloud UG (haftungsbeschrankt) from 5 sources40
AS12876 Scaleway SAS from 3 sources38
AS219502 Storm Industries LLC from 2 sources30
AS216014 BestDC Limited from 1 source26
AS209630 LLC Vash Kredit Bank from 1 source24

Countries

Source addresses (unverified)

Address	Network	Cc	Sends	Datagrams	Last seen (UTC)
45.135.193.115	AS51396 Pfcloud UG (haftungsbeschrankt)	DE	DNS	27	2026-10-11 02:15
193.47.62.187	AS216014 BestDC Limited	BG	DNS	26	2026-10-07 11:10
151.243.11.230	AS209630 LLC Vash Kredit Bank	AE	DNS	24	2026-10-09 20:04
18.226.68.29	AS16509 Amazon.com, Inc.	US	DNS	23	2026-10-06 13:13
94.154.43.109	AS219502 Storm Industries LLC	NL	DNS	22	2026-10-09 08:45
141.98.11.129	AS209605 UAB Host Baltic	LT	DNS	22	2026-10-11 06:07
51.158.205.203	AS12876 Scaleway SAS	NL	DNS	20	2026-10-11 00:48
185.73.23.133	AS29484 Ruhr-Universitaet Bochum	DE	DNS	20	2026-10-10 09:32
45.205.1.231	AS215925 Vpsvault.host Ltd	BR	DNS	20	2026-10-11 01:20
45.198.224.251	AS215925 Vpsvault.host Ltd	US	DNS	19	2026-10-11 05:42
66.132.172.249	AS398324 Censys, Inc.	US	DNS	19	2026-10-11 05:05
141.98.83.48	AS209588 Flyservers S.A.	PA	DNS	19	2026-10-11 06:13
62.210.142.176	AS12876 Scaleway SAS	FR	DNS	17	2026-10-10 16:28
216.180.246.230	AS396982 Google LLC	US	DNS	17	2026-10-07 11:04
216.180.246.141	AS396982 Google LLC	US	DNS	17	2026-10-10 11:12
216.180.246.225	AS396982 Google LLC	US	DNS	17	2026-10-07 11:15
216.180.246.217	AS396982 Google LLC	US	DNS	17	2026-10-07 16:46
216.180.246.101	AS396982 Google LLC	US	DNS	17	2026-10-10 11:02
16.5.0.234	AS401661 EMBNEX, LLC	BR	DNS	15	2026-10-05 19:11
185.94.111.1	AS51115 HLL LLC	RU	DNS	15	2026-10-10 18:34

Latest datagrams

2026-10-11 07:07:1165.49.1.90to 53/udpDNSUS

DNS query A dnsscan.shadowserver.org

payload bytes

00000000  fa ce 01 00 00 01 00 00  00 00 00 00 07 64 6e 73  |.............dns|
00000010  73 63 61 6e 0c 73 68 61  64 6f 77 73 65 72 76 65  |scan.shadowserve|
00000020  72 03 6f 72 67 00 00 01  00 01                    |r.org.....|

2026-10-11 06:38:5165.49.1.95to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-11 06:25:59146.88.241.40to 53/udpDNSUS
DNS query A 00065d8aa7a77bed.9d56.<HONEYPOT>.asertdnsresearch.com
Payload bytes withheld: they contain the sensor's address.

2026-10-11 06:25:1465.49.1.95to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-11 06:22:27146.88.241.110to 5353/udpDNSUS

DNS query PTR _services._dns-sd._udp.local

payload bytes

00000000  00 00 00 00 00 01 00 00  00 00 00 00 09 5f 73 65  |............._se|
00000010  72 76 69 63 65 73 07 5f  64 6e 73 2d 73 64 04 5f  |rvices._dns-sd._|
00000020  75 64 70 05 6c 6f 63 61  6c 00 00 0c 00 01        |udp.local.....|

2026-10-11 06:13:46141.98.83.48to 53/udpDNSPA

DNS query ANY ferc.gov

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 04 66 65 72  |Eg...........fer|
00000010  63 03 67 6f 76 00 00 ff  00 01 00 00 29 ff ff 00  |c.gov.......)...|
00000020  00 00 00 00 00                                    |.....|

2026-10-11 06:11:10141.98.83.48to 53/udpDNSPA

DNS query ANY ferc.gov

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 04 66 65 72  |Eg...........fer|
00000010  63 03 67 6f 76 00 00 ff  00 01 00 00 29 ff ff 00  |c.gov.......)...|
00000020  00 00 00 00 00                                    |.....|

2026-10-11 06:07:51141.98.11.129to 53/udpDNSLT

DNS query ANY ni

payload bytes

00000000  c8 f3 01 00 00 01 00 00  00 00 00 01 02 6e 69 00  |.............ni.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-11 06:07:27141.98.83.48to 53/udpDNSPA

DNS query ANY ferc.gov

payload bytes

00000000  45 67 01 00 00 01 00 00  00 00 00 01 04 66 65 72  |Eg...........fer|
00000010  63 03 67 6f 76 00 00 ff  00 01 00 00 29 ff ff 00  |c.gov.......)...|
00000020  00 00 00 00 00                                    |.....|

2026-10-11 05:53:41141.98.11.129to 53/udpDNSLT

DNS query ANY ni

payload bytes

00000000  c8 f3 01 00 00 01 00 00  00 00 00 01 02 6e 69 00  |.............ni.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|

2026-10-11 05:47:16150.40.126.53to 53/udpDNSRS

DNS query ANY duo.nl

payload bytes

00000000  00 01 01 00 00 01 00 00  00 00 00 00 03 64 75 6f  |.............duo|
00000010  02 6e 6c 00 00 ff 00 01                           |.nl.....|

2026-10-11 05:42:4445.198.224.251to 53/udpDNSUS

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

2026-10-11 05:38:0845.198.224.251to 53/udpDNSUS

DNS query ANY wisc.edu

payload bytes

00000000  12 71 01 00 00 01 00 00  00 00 00 01 04 77 69 73  |.q...........wis|
00000010  63 03 65 64 75 00 00 ff  00 01 00 00 29 20 00 00  |c.edu.......) ..|
00000020  00 80 00 00 00                                    |.....|

2026-10-11 05:35:17150.40.126.53to 53/udpDNSRS

DNS query ANY duo.nl

payload bytes

00000000  00 01 01 00 00 01 00 00  00 00 00 00 03 64 75 6f  |.............duo|
00000010  02 6e 6c 00 00 ff 00 01                           |.nl.....|

2026-10-11 05:35:16141.98.11.129to 53/udpDNSLT

DNS query ANY ni

payload bytes

00000000  c8 f3 01 00 00 01 00 00  00 00 00 01 02 6e 69 00  |.............ni.|
00000010  00 ff 00 01 00 00 29 ff  ff 00 00 00 00 00 00     |......)........|